mlsanityData to 7 Oct 2026

MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models

arXiv 1612.04433 ↗First posted 13 Dec 2016cs.CRcited by 29

Not on the map. Why?

Abstract (arXiv)

The rise in popularity of the Android platform has resulted in an explosion of malware threats targeting it. As both Android malware and the operating system itself constantly evolve, it is very challenging to design robust malware mitigation techniques that can operate for long periods of time without the need for modifications or costly re-training. In this paper, we present MaMaDroid, an Android malware detection system that relies on app behavior. MaMaDroid builds a behavioral model, in the form of a Markov chain, from the sequence of abstracted API calls performed by an app, and uses it to extract features and perform classification. By abstracting calls to their packages or families, MaMaDroid maintains resilience to API changes and keeps the feature set size manageable. We evaluate its accuracy on a dataset of 8.5K benign and 35.5K malicious apps collected over a period of six years, showing that it not only effectively detects malware (with up to 99% F-measure), but also that the model built by the system keeps its detection capabilities for long periods of time (on average, 86% and 75% F-measure, respectively, one and two years after training). Finally, we compare against DroidAPIMiner, a state-of-the-art system that relies on the frequency of API calls performed by apps, showing that MaMaDroid significantly outperforms it.

Key facts. Cited by 29 papers in the map (data through 7 Oct 2026). First posted on arXiv 13 Dec 2016.

Builds on

No reference list yet.

Built on by

Cited by year

Citing papers per year: 2021: 4; 2022: 6; 2023: 4; 2024: 6; 2025: 9.

29 papers.

Sort:

  1. 2023Continuous Learning for Android Malware Detectioncited by 33
  2. 2021Deep Learning for Android Malware Defenses: a Systematic Literature Reviewcited by 18
  3. 2021EvadeDroid: A Practical Evasion Attack on Machine Learning for Black-box Android Malware Detectioncited by 13
  4. 2022On the Limitations of Continual Learning for Malware Classificationcited by 12
  5. 2023FINER: Enhancing State-of-the-art Classifiers with Feature Attribution to Facilitate Security Analysiscited by 12
  6. 2025On Benchmarking Code LLMs for Android Malware Analysiscited by 12
  7. 2023Efficient Query-Based Attack against ML-Based Android Malware Detection under Zero Knowledge Settingcited by 10
  8. 2024TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time (Extended Version)cited by 9
  9. 2021Mate! Are You Really Aware? An Explainability-Guided Testing Framework for Robustness of Malware Detectorscited by 7
  10. 2024Combating Concept Drift with Explanatory Detection and Adaptation for Android Malware Classificationcited by 7
  11. 2022Towards a Fair Comparison and Realistic Evaluation Framework of Android Malware Detectors based on Static Analysis and Machine Learningcited by 6
  12. 2025LAMDA: A Longitudinal Android Malware Benchmark for Concept Drift Analysiscited by 6
17 more
  1. 2023PAD: Towards Principled Adversarial Malware Detection Against Evasion Attackscited by 5
  2. 2024Unraveling the Key of Machine Learning-based Android Malware Detectioncited by 4
  3. 2024A Survey of Source Code Representations for Machine Learning-Based Cybersecurity Taskscited by 4
  4. 2022A two-steps approach to improve the performance of Android malware detectorscited by 2
  5. 2025Defending against Adversarial Malware Attacks on ML-based Android Malware Detection Systemscited by 2
  6. 2025Regression-aware Continual Learning for Android Malware Detectioncited by 2
  7. 2021Android Malware Category and Family Detection and Identification using Machine Learningcited by 1
  8. 2022MaMaDroid2.0 -- The Holes of Control Flow Graphscited by 1
  9. 2022The State-of-the-Art in AI-Based Malware Detection Techniques: A Reviewcited by 1
  10. 2024R+R: Revisiting Static Feature-Based Android Malware Detection using Machine Learningcited by 1
  11. 2024MASKDROID: Robust Android Malware Detection with Masked Graph Representationscited by 1
  12. 2025On the Security Risks of ML-based Malware Detection Systems: A Surveycited by 1
  13. 2025On the Reliability and Stability of Selective Methods in Malware Classification Taskscited by 1
  14. 2022Adversarial Patterns: Building Robust Android Malware Classifierscited by 0
  15. 2025Evaluating the robustness of adversarial defenses in malware detection systemscited by 0
  16. 2025BinCtx: Multi-Modal Representation Learning for Robust Android App Behavior Detectioncited by 0
  17. 2025MH-1M: A 1.34 Million-Sample Comprehensive Multi-Feature Android Malware Dataset for Machine Learning, Deep Learning, Large Language Models, and Threat Intelligence Researchcited by 0